An opensuse version or so ago, kernel updates were a once or twice a year event. Now they are bi-weekly or even weekly. Are these due to new features, security issues, correcting programming mistakes, or what?
Where can one view the changes included in the latest kernel update?
Also, is there a zypper feature to exclude specific updates for a time period or does one just install others one at a time and leave kernel updates in the queue?
I would think that managers of large unattended computer banks would not be happy to see weekly reboots.
I am nervous when I see a kernel update as I am afraid that this kernel update could hose my system requiring a reinstall, especially due to problems with the nvidia graphics, as has happened a few times in the past.
On a Leap system, only security and recommended patches are provided. That is also true for the kernel. Thus, you will probably not get a"new" kernel (one with new features, etc.), but the same kernel with, when needed retrofitted, patches. Look at the version numbers (e.g. with YaST > Software Management and Seaching for kernel-default), probably only the build number after the _ sign there is something starting with lp15.3. That is the build number. What is before it is de real kernel version.
I have 15.2, all the kernel versions available are 5.3.18. After it is -lp152.19.2 until 152.87.1. All new builds required by mostly security issues over the time of existence of 15.2 until now.
I do not know how you patch/update your system, but using YaST > Online Update, you get the patches presented at left. When clicking on them, you get a description below. Right now on 15.2 for the -lp152.87.1 build:
openSUSE-2021-1142 - Security update for the Linux Kernel
The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
CVE-2021-3679: A lack of CPU resource in the Linux kernel tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with …
and this text goes on for some length.
When you want to postpone such a patch to a moment that better suits you, but nevertheless want to install the other patches, you can Taboo the package (kernel-default) for the time being.
I don’t do updates through yast, only zypper. I will activate yast update to see these changes.
I am still wondering why the frequency has gone up so dramatically.
I am sorry about two post on this subject. I tried to correct mispelling in title but “edit” would not let me so I wrote a new one. I can’t see how to delete one.
hacking has become more frequent - ways to get privileges that you should not have are being fixed as fast as reported.
new chip sets in computers have to be supported - this includes CPU’s and bug fixes for them.
additions checks for attempts to load drivers that are malware. these guy just keep trying and you don’t want them on your machines.
there are a lot more users reporting problems - not only openSUSE but the other flavors, fedora, ubuntu, arch, debian - are all finding things needing corrections - but maybe not for your hardware.
Well, yes. I shall do that next time, now that you made me aware of it. lol! I have to admit I normally don’t check such details thoroughly. They just pop up if one follows the “New Posts” function of the forum.
From the supplied refs, I see now that kernel update to kernel-default-5.3.18-59.19.1 (this morning for me), repaired 7 vulnerabilities and did 58 app fixes. Impressive. I was unaware that this info was around. Appreciate learning about it.
One question, where and who does this fixes? This looks to be more than volunteer work? Novell staff?
Also, one minor question is what is openSUSE timezone to which messages are referenced? Germany?
david@atronach-opensuse:~> LANG=c zypper list-patches
Repository 'multimedia-apps' is out-of-date. You can run 'zypper refresh' as root to update it.
Loading repository data...
Reading installed packages...
Repository | Name | Category | Severity | Interactive | Status | Summary
----------------------+-----------------------------+-------------+-----------+-------------+--------+---------------------------------------------
repo-backports-update | openSUSE-2021-1133 | recommended | moderate | --- | needed | Recommended update for keepassxc
repo-sle-update | openSUSE-SLE-15.3-2021-2654 | recommended | moderate | --- | needed | Recommended update for system-config-printer
repo-sle-update | openSUSE-SLE-15.3-2021-2687 | security | important | reboot | needed | Security update for the Linux Kernel
Found 3 applicable patches:
3 patches needed (1 security patch)
Second, list details of that particular patch:
david@atronach-opensuse:~> LANG=c zypper info --type patch openSUSE-SLE-15.3-2021-2687
Repository 'multimedia-apps' is out-of-date. You can run 'zypper refresh' as root to update it.
Loading repository data...
Reading installed packages...
Information for patch openSUSE-SLE-15.3-2021-2687:
--------------------------------------------------
Repository : repo-sle-update
Name : openSUSE-SLE-15.3-2021-2687
Version : 1
Arch : noarch
Vendor : maint-coord@suse.de
Status : needed
Category : security
Severity : important
Created On : Sat Aug 14 10:16:56 2021
Interactive : reboot
Summary : Security update for the Linux Kernel
Description :
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
- CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
- CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages
being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to
read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
- CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via
rtas_args.nargs (bsc#1188838).
- CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
- CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to
crash the system or possibly escalate their privileges on the system. (bsc#1187585)
- CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is
signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).
...]
Alternatively, you can list the changelog for already installed packages:
david@atronach-opensuse:~> LANG=c sudo zypper addlock kernel-default
Specified lock has been successfully added.
david@atronach-opensuse:~> LANG=c sudo zypper up kernel-default
Retrieving repository 'multimedia-apps' metadata ..............................................................................[done]
Building repository 'multimedia-apps' cache ...................................................................................[done]
Loading repository data...
Reading installed packages...
Resolving package dependencies...
Problem: conflicting requests
Solution 1: remove lock to allow installation of kernel-default-5.3.18-59.19.1.x86_64[repo-sle-update]
Solution 2: do not ask to install a solvable providing kernel-default.x86_64 = 5.3.18-59.19.1
Choose from above solutions by number or cancel [1/2/c/d/?] (c):
And similarly, for a patch:
david@atronach-opensuse:~> LANG=c sudo zypper addlock --type patch openSUSE-SLE-15.3-2021-2687
Specified lock has been successfully added.
david@atronach-opensuse:~> LANG=c sudo zypper update --type patch openSUSE-SLE-15.3-2021-2687
Loading repository data...
Reading installed packages...
Patch 'openSUSE-SLE-15.3-2021-2687-1' is locked. Use 'zypper in --force patch:openSUSE-SLE-15.3-2021-2687' to install it, or unlock it using 'zypper rl patch:openSUSE-SLE-15.3-2021-2687'.
Resolving package dependencies...
The following 12 items are locked and will not be changed by any action:
Available:
MozillaFirefox autoyast2-installation grub2-systemd-sleep-plugin intel-vaapi-driver kate libreoffice-gnome
patch:openSUSE-SLE-15.3-2021-2687 plymouth vlc xf86-video-fbdev xf86-video-vesa yast2-snapper
Nothing to do.
Note that you don’t have to specify the –type option if you want to lock a regular package - it’s selected by default, but if you want to lock a patch you have to add –type patch to the addlock command, otherwise you end up with locking a non-existing package (because patch has a different name) and the patch itself will still be not locked.